1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
|
#!/usr/bin/lua
package.path = "/usr/lib/lua/?.lua;/usr/lib/lua/?/init.lua;" .. package.path
package.cpath = "/usr/lib/lua/?.so;" .. package.cpath
require("ffluci.http")
require("ffluci.sys")
require("ffluci.model.uci")
-- Init state session
uci = ffluci.model.uci.Session("/var/state")
-- Parse stdin and do something
function main(argv)
local cmd = argv[1]
local arg = argv[2]
if not cmd then
print("Usage: " .. argv[0] .. " <status|add|remove|sync> [MAC]")
os.exit(1)
elseif cmd == "status" then
if not arg then
os.exit(1)
end
if iswhitelisted(arg) then
print("whitelisted")
os.exit(0)
end
if haslease(arg) then
print("lease")
os.exit(0)
end
print("unknown")
os.exit(0)
elseif cmd == "add" then
if not arg then
os.exit(1)
end
if not haslease(arg) then
add_lease(arg)
else
print("already leased!")
os.exit(2)
end
os.exit(0)
elseif cmd == "remove" then
if not cmd[2] then
os.exit(1)
end
remove_lease(arg)
os.exit(0)
elseif cmd == "sync" then
sync()
os.exit(0)
end
end
-- Add a lease to state and invoke add_rule
function add_lease(mac)
local key = uci:add("luci_splash", "lease")
uci:set("luci_splash", key, "mac", mac)
uci:set("luci_splash", key, "start", os.time())
add_rule(mac)
end
-- Remove a lease from state and invoke remove_rule
function remove_lease(mac)
mac = mac:lower()
for k, v in pairs(uci:show("luci_splash").luci_splash) do
if v.mac:lower() == mac then
remove_rule(mac)
uci:del("luci_splash", k)
end
end
end
-- Add an iptables rule
function add_rule(mac)
return os.execute("iptables -t nat -I luci_splash_leases -m mac --mac-source '"..mac.."' -j RETURN")
end
-- Remove an iptables rule
function remove_rule(mac)
return os.execute("iptables -t nat -D luci_splash_leases -m mac --mac-source '"..mac.."' -j RETURN")
end
-- Check whether a MAC-Address is listed in the lease state list
function haslease(mac)
mac = mac:lower()
for k, v in pairs(uci:show("luci_splash").luci_splash) do
if v[".type"] == "lease" and v.mac and v.mac:lower() == mac then
return true
end
end
return false
end
-- Check whether a MAC-Address is whitelisted
function iswhitelisted(mac)
mac = mac:lower()
for k, v in pairs(uci:show("luci_splash").luci_splash) do
if v[".type"] == "whitelist" and v.mac and v.mac:lower() == mac then
return true
end
end
return false
end
-- Returns a list of MAC-Addresses for which a rule is existing
function listrules()
local cmd = "iptables -t nat -L luci_splash_leases | grep RETURN |"
cmd = cmd .. "egrep -io [0-9a-f]+:[0-9a-f]+:[0-9a-f]+:[0-9a-f]+:[0-9a-f]+:[0-9a-f]+"
return ffluci.util.split(ffluci.sys.exec(cmd))
end
-- Synchronise leases, remove abandoned rules
function sync()
local written = {}
local time = os.time()
-- Current leases in state files
local leases = uci:show("luci_splash").luci_splash
-- Convert leasetime to seconds
local leasetime = tonumber(uci:get("luci_splash", "general", "leasetime")) * 3600
-- Clean state file
uci:revert("luci_splash")
-- For all leases
for k, v in pairs(uci:show("luci_splash")) do
if v[".type"] == "lease" then
if os.difftime(time, tonumber(v.start)) > leasetime then
-- Remove expired
remove_rule(v.mac)
else
-- Rewrite state
local n = uci:add("luci_splash", "lease")
uci:set("luci_splash", n, "mac", v.mac)
uci:set("luci_splash", n, "start", v.start)
written[v.mac] = 1
end
end
end
-- Delete rules without state
for i, r in ipairs(listrules()) do
if #r > 0 and not written[r] then
remove_rule(r)
end
end
end
main(arg)
|
